Behaviour

Hey folks, similar to #191 a bit, when running a workflow on a PR event, the {{ sha }} refers to the temporary merge commit to the target branch, not the commit that was pushed to trigger the event.

I realize this is a pretty common situation with GitHub actions, but it ends up with Docker tags/labels that don't map back to any real commits. It would be really useful if this action automatically used github.event.pull_request.head.sha for PR events. I think it would have to be set for the tags {{ sha }} value and the auto-generated label org.opencontainers.image.revision.

I'm aware we can work around the tags situation by using type=raw and passing a value based on github.event.pull_request.head.sha, but it feels a bit error-prone.

I'm unaware of a workaround for overriding the org.opencontainers.image.revision label, though.

Steps to reproduce this issue

See example workflow and run on a PR

Expected behaviour

Tags with the correct sha in a PR (same with org.opencontainers.image.revision label)

Actual behaviour

Tags are created with the merge commit of the PR to the target branch (same with org.opencontainers.image.revision)

name: AWS

on:
  push:
    branches: ["main"]
    tags: ["v*"]
  pull_request:
    branches: ["*"]

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: "my-repo/my-image"
          tags: |
            type=ref,event=branch,suffix=-{{ sha }}
            type=ref,event=pr,suffix=-{{ sha }}